We take the state-of-the-art method DeepJudge [1]} as a baseline against DRW. DeepJudge quantitatively tests the similarities between the victim model and suspect model, then determines whether the suspect model is a copy based on the testing metrics. Since DeepJudge is designed for continuous signals such as images and audio, we modify the method to apply it to texts. We consider the black-box setting for DeepJudge, and compute Jensen-Shanon Distance (\(JSD\) ) [2]} for the probing dataset of the victim model and the extracted model. \(JSD\)  measures the similarity of two probability distributions. We use the probing dataset to query both the victim model and the suspect model, and then calculate \(JSD\)  of the output layer as follows
\(\text{\small $JSD\left(\hat{\mathbf {y}}, \hat{\mathbf {q}}\right)=\frac{1}{2|\mathcal {D}_p|} \sum _{x \in \mathcal {D}_p} K\left(\hat{\mathbf {y}}(x), u\right)+K\left(\hat{\mathbf {q}}(x), u\right)$}\) 
